CVE-2026-9520: Blitz.js XSS Vulnerability

CVE-2026-9520 Overview

CVE-2026-9520 is a reflected cross-site scripting (XSS) vulnerability in the blitz-js framework affecting versions up to 3.0.2. The flaw resides in the sign-in component, specifically in the packages/generator/templates/app/src/app/auth/components/LoginForm.tsx file. Attackers can manipulate the Next argument to inject malicious script content that executes in the victim's browser. The vulnerability is exploitable remotely and requires user interaction. Public exploit code is available on GitHub Gist. The maintainers were notified prior to disclosure but did not respond, leaving the issue unpatched at the time of publication.

Critical Impact
Remote attackers can inject arbitrary JavaScript into the blitz-js sign-in flow through the Next parameter, enabling session theft, credential harvesting, or redirection of authenticated users.

Affected Products

blitz-js blitz versions up to and including 3.0.2
The LoginForm.tsx component within packages/generator/templates/app/src/app/auth/components/
Applications scaffolded from the affected blitz-js generator templates

Discovery Timeline

2026-05-26 - CVE-2026-9520 published to the National Vulnerability Database (NVD)
2026-05-26 - Last updated in the NVD database

Technical Details for CVE-2026-9520

Vulnerability Analysis

The vulnerability is classified as cross-site scripting under [CWE-79]. It affects the sign-in workflow in blitz-js, a full-stack React framework. The LoginForm.tsx component accepts a Next argument that controls post-authentication redirection. The component fails to properly sanitize or validate this argument before reflecting it into the rendered output. Attackers can craft URLs containing JavaScript payloads in the Next parameter and deliver them to victims through phishing emails, malicious links, or compromised pages. When a victim interacts with the crafted link, the payload executes in the browser context of the blitz-js application.

Root Cause

The root cause is missing input sanitization on the Next argument processed by the LoginForm.tsx component. User-supplied data is incorporated into the page without contextual output encoding, violating the principle of treating all client-supplied input as untrusted.

Attack Vector

Exploitation requires network access and user interaction. An attacker constructs a URL targeting the affected sign-in endpoint with a malicious Next parameter value. The victim must click the link or visit the crafted page. Upon rendering, the injected script runs with the privileges of the application origin, allowing the attacker to steal session cookies, manipulate the document object model (DOM), or initiate further attacks against authenticated users. Public exploit code is available through a GitHub Gist referenced by VulDB #365540.

No verified code examples are reproduced here. Refer to the linked references for technical details on the payload structure.

Detection Methods for CVE-2026-9520

Indicators of Compromise

Inbound HTTP requests to the sign-in route containing Next parameter values with <script>, javascript:, onerror=, or URL-encoded equivalents
Referrer logs showing external sources delivering links to the application's login endpoint with unusual query strings
Browser console errors or unexpected script execution reported by users during sign-in

Detection Strategies

Inspect web server and application logs for the Next query parameter and flag values that contain HTML or JavaScript syntax
Deploy a Web Application Firewall (WAF) rule that matches reflected XSS signatures against parameters passed to the login route
Conduct static analysis of any deployed blitz-js code to confirm whether the vulnerable LoginForm.tsx template is in use

Monitoring Recommendations

Aggregate authentication endpoint logs into a centralized logging platform and alert on anomalous redirect parameter content
Monitor for unusual session token reuse from disparate IP addresses following user clicks on external links
Track Content Security Policy (CSP) violation reports if CSP is enforced, since blocked inline scripts indicate active exploitation attempts

How to Mitigate CVE-2026-9520

Immediate Actions Required

Audit deployed blitz-js applications to identify use of LoginForm.tsx from versions up to 3.0.2
Apply server-side validation that restricts the Next parameter to relative paths matching an allowlist of known application routes
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources on authentication pages

Patch Information

No vendor patch is available at the time of publication. The maintainers did not respond to the disclosure. Track the VulDB advisory and the blitz-js project repository for an official fix.

Workarounds

Replace the vulnerable Next handling logic with a custom function that parses the value as a URL and rejects any value that is not a same-origin relative path
Apply output encoding using a vetted library such as DOMPurify before reflecting any user-supplied redirect targets
Deploy a reverse proxy or WAF rule to strip or sanitize Next query parameters on requests to the sign-in route until a vendor patch is released

bash

# Example WAF rule (ModSecurity) blocking script content in the Next parameter
SecRule ARGS:Next "@rx (?i)(<script|javascript:|on\w+\s*=)" \
    "id:1009520,phase:2,deny,status:400,log,\
    msg:'CVE-2026-9520 blitz-js XSS attempt in Next parameter'"